Permit dev.tapcat
CORS hosts reverted